# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
borderware_runstats = {

  plugin_version = "1.0.1"

  # Initial creation - 1.0
  # 2010-10-14 - 1.0.1 - MSG - Edited info lines.

  info.1.manufacturer = "Borderware"
  info.1.device = "Runstats"
  info.1.version.1 = ""

  # The name of the log format
  log.format.format_label = "Borderware runstats Log Format"
  log.miscellaneous.log_data_type = "syslog_required"
  log.miscellaneous.log_format_type = "other"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = ",run stats for,[^,]+,src addr=,"

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    process = {
      label = "$lang_stats.field_labels.process"
      type = "flat"
    } # process

    src_addr = {
      label = "$lang_stats.field_labels.src_addr"
      type = "host"
      hierarchy_dividers = "."
      left_to_right = false
      leading_divider = "false"
    } # src_addr

    dest_addr = {
      label = "$lang_stats.field_labels.dest_addr"
      type = "flat"
    } # dest_addr

    port = {
      label = "$lang_stats.field_labels.port"
      type = "flat"
    } # port

    bytes_in = {
      label = "$lang_stats.field_labels.bytes_in"
      type = "flat"
    } # bytes_in

    bytes_out = {
      label = "$lang_stats.field_labels.bytes_out"
      type = "flat"
    } # bytes_out

    cpu_time = {
      label = "$lang_stats.field_labels.cpu_time"
      type = "flat"
    } # cpu_time

    actual_time = {
      label = "$lang_stats.field_labels.actual_time"
      type = "flat"
    } # actual_time

  } # log.fields


  # Log Parsing Filters
  log.parsing_filters = {

    parse = {
      label = "parse"
      comment = ""
      value = "
if (matches_regular_expression(current_log_line(), '(,run stats for,.*)$')) then (
  virtual.list = $1;

  # Strip off the name/value pairs one at a time, and set the appropriate fields
  while (matches_regular_expression(virtual.list, '^,([^,]+),([^,]+)(.*)$')) (
    virtual.name = $1;
    virtual.value = $2;
    virtual.list = $3;
    virtual.name = replace_all(virtual.name, ' ', '_');
    virtual.name = replace_last(virtual.name, '=', '');
    if (virtual.name eq 'run_stats_for') then virtual.name = 'process';
    set_collected_field('', virtual.name, virtual.value);
  );
  accept_collected_entry('', false);
)
"
    } # parse

  } # parsing_filters


  # Database fields
  database.fields = {

    process = {
      label = "$lang_stats.field_labels.process"
      log_field = "process"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # process

    src_addr = {
      label = "$lang_stats.field_labels.src_addr"
      log_field = "src_addr"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
      display_format_type = "hostname"
    } # src_addr

    dest_addr = {
      label = "$lang_stats.field_labels.dest_addr"
      log_field = "dest_addr"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # dest_addr

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    bytes_in = {
      label = "$lang_stats.field_labels.bytes_in"
      default = false
      log_field = "bytes_in"
      requires_log_field = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    }

    bytes_out = {
      label = "$lang_stats.field_labels.bytes_out"
      default = false
      log_field = "bytes_out"
      requires_log_field = true
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    }

    cpu_time = {
      label = $lang_stats.field_labels.cpu_time
      default = false
      requires_log_field = true
      type = float
      display_format_type = duration
    } # cpu_time

    actual_time = {
      label = $lang_stats.field_labels.actual_time
      default = false
      requires_log_field = true
      type = float
      display_format_type = duration
    } # actual_time

  } # database.numerical_fields


  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {
    date_time_tracking = true

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      process = true
      src_addr = true
      dest_addr = true
      port = true
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
    sessions = true
  } # not_supported

} # borderware_runstats